Privacy Policy

Last updated: 2026/11/09

1.Introduction

This Global Privacy Policy (the “Policy”) explains how OYH collects, uses, shares, stores and protects personal data when you visit www.oyh.com and the OYH country sites (together, the “Website”), contact us through the Website, apply for a job, or deal with us as a customer, distributor, partner, supplier, government client or investor.

OYH Overseas Development Group Co., Ltd. (东方雨虹海外建设发展（上海）有限公司) (“OYH Overseas”) owns the Website and issues this Policy. In this Policy, “OYH”, “we” and “us” mean OYH Overseas together with the Oriental Yuhong group headquarters in Beijing (the “OYH Headquarters”) and the group companies that operate a country site or handle enquiries received through it (the “local teams”). “Personal data” means any information about an identified or identifiable individual, and includes “personal information” under the laws of your country.

The Website is designed for business visitors, such as contractors, developers, distributors, dealers, suppliers, government project owners, investors and job applicants. It does not offer online sales or payments to individual consumers. Our Legal Notice sets the terms for using the Website. This Policy covers personal data.

This Policy applies to everyone. Annex 1 adds the terms that the law of certain countries or regions requires. If you are in one of them, read the addendum for your country or region together with the main body. If the two conflict, Annex 1 prevails to the extent your local law requires.

2.Who is responsible for your personal data

OYH Overseas collects the personal data entered on the Website directly from you and is responsible for it. The OYH Headquarters and the local teams handle it for OYH. In Hong Kong SAR, the United States and Mexico, where the local team handles enquiries from its own country/region site, the local company named in Annex 1 is also responsible for that data, and you may contact either company.

You can reach OYH’s privacy contact at any time at privacy@oyh.com (the “Privacy Contact”). The Privacy Contact is also the contact point for any data protection officer or privacy officer enquiry.

3.Personal data we collect

The table below shows what we collect and how. Some form fields are needed to answer you, and where a form marks a field as required you must complete it. Other fields are optional.

We also receive your business contact details from colleagues within OYH who handle your enquiry.

We do not ask for identity document numbers, bank account details, precise location, health information, biometric data or information about children. Please do not send them to us. If your CV or an attachment contains them, we handle them only as far as needed for your application or enquiry, and in line with your local law.

If you give us personal data about someone else, for example a colleague as a contact person, please make sure you are entitled to do so.

4.How we use personal data

The legal basis for each purpose depends on your country. Depending on the law that applies, we rely on:

1. your request, or steps taken at your request before entering into a contract with you;

2. our legitimate interests in running a business-to-business operation, where your local law recognizes legitimate interests and your rights do not override them;

3. your consent, where your local law requires it. This includes marketing, optional cookies and, in some countries, sending your data abroad or to group companies; and

4. legal obligations.

Where we rely on your consent, we ask for it separately from this Policy, and we do not make consent to marketing a condition of answering your enquiry. You can withdraw consent at any time by contacting the Privacy Contact or using the unsubscribe link. Withdrawal does not affect processing done before you withdrew.

We do not sell your personal data. We do not use your data for targeted advertising, and the Website does not currently show advertising. We do not make decisions about you that are based only on automated processing and have legal or similarly significant effects. If we plan to do any of this, we will update this Policy first and obtain consent where the law requires it.

5.Cookies and similar technologies

We use cookies and similar technologies to make the Website work, remember your choices, and measure how it is used.

1. Strictly necessary: needed for security, basic functions and to remember your cookie choices. These do not need consent.

2. Preferences: remember settings such as language and the site you chose, so you do not have to set them again.

3. Statistics: we use Google Analytics to count visits and understand how visitors use the Website. We do not use Google’s advertising features or link Analytics to advertising accounts.

4. Marketing: we do not currently use marketing or advertising cookies.

Cookiebot, our consent manager, shows a banner when you first visit. You can accept, reject or adjust non-essential cookies, and change your choice later through the cookie settings link in the footer. The live-chat service sets its own cookies when you open the chat window. The Cookie Policy gives details of the cookies we use.

We use your IP address to work out your country and offer you the matching country site. You can stay on the site you chose.

6.Who we share personal data with

OYH group. The OYH Headquarters and OYH Overseas can see the personal data collected through every OYH site. A local team can see only the data from its own country site. Each country site has its own back-end system with separate log-in credentials. On all country/region sites except Hong Kong SAR, the United States, Mexico and Cambodia, enquiries go first to the OYH Headquarters, which then passes them to the local team. The teams in those four places handle their own enquiries. Recruitment data is also shared between the OYH Headquarters and the local team. We share data within the group to answer your enquiry, manage the relationship, run the Website, and keep records and security.

Service providers. We use providers that maintain the Website, provide live chat, analytics and cookie management, and, once launched, send marketing emails and support the AI assistant. They include website hosting and maintenance providers, a live-chat provider (JivoChat), analytics (Google Analytics) and cookie management (Cookiebot) providers, and, once launched, email marketing and AI assistant providers. Some of them are outside your country. We require them to keep your data confidential and to use it only to provide services to us.

Distributors and agents. We do not pass your enquiry or contact details to distributors or agents. If you want a local distributor, we give you the distributor’s contact details and you decide whether to contact them. If this changes, we will ask for your consent first and update this Policy.

Authorities and legal reasons. We disclose personal data when the law requires it, in response to valid requests from courts or authorities, or to establish, exercise or defend legal claims.

Corporate transactions. If OYH takes part in a merger, acquisition, restructuring or sale of assets, we may pass personal data to the other parties and their advisers, subject to confidentiality obligations.

7.Where we store personal data and transfers abroad

OYH operates in several countries/regions, so your personal data is stored in, and accessed from, countries/regions other than your own.

The OYH Headquarters in Beijing can access data from all sites from mainland China. The local teams can access only the data from their own country site, from the country where they work. Service providers may handle data in their own countries. Because the OYH Headquarters and the local teams exchange enquiries and recruitment data, a record can be held in more than one place.

Because we collect your personal data directly through the Website, it is stored in and accessed from China (including Hong Kong SAR), Singapore and the United States, for the purposes in Section 4 and by the recipients described in Section 6. Where the law of your country has rules on sending personal data abroad that apply to us, we follow them. Depending on that law, this may be because the destination offers protection your law treats as adequate, because of contractual safeguards such as standard contractual clauses, because you have given the consent your law requires, or because another exception applies, for example where the transfer is necessary to respond to your request. Where your law requires your consent, we obtain it. Annex 1 describes additional rules for particular countries. You can ask the Privacy Contact for more information.

8.How long we keep personal data

We keep personal data only for as long as we need it for the purposes in Section 4, and for any longer period the law requires or allows, for example to deal with legal claims. When we no longer need it, we delete it or make it anonymous.

How long that is depends on the type of data and what we use it for. In general:

1. enquiry and sales contact data: for as long as the business relationship or opportunity continues, and a reasonable period afterwards;

2. CVs and application data: for the recruitment process, and a reasonable period afterwards so that we can consider you for other roles, unless you ask us to delete them;

3. marketing subscriptions: until you unsubscribe, after which we keep a minimal record so that we do not contact you again;

4. live-chat records, server logs and analytics data: for a limited period that we need for service, security and analysis.

   
   

9.Security

We take reasonable technical and organizational measures to protect personal data against loss, misuse, unauthorized access, disclosure and alteration. These include limiting access to the staff who need it, and keeping a separate back-end system and log-in credentials for each country site.

No system is completely secure. If a personal data breach affects you, we will notify the competent authority and you where the law requires.

10.Your rights and how to exercise them

Depending on where you live, you may have the right to:

1. know what personal data we hold about you and receive a copy;

2. have inaccurate or incomplete data corrected;

3. have your data deleted, or its use restricted, in the cases the law provides;

4. object to our processing, including for direct marketing, and withdraw consent;

5. ask for your data in a portable format, where the law provides this right;

6. ask for human review of an automated decision that significantly affects you; and

7. complain to the data protection authority in your country.

To exercise a right, contact the Privacy Contact at privacy@oyh.com, or the local team of your country site. Tell us which right you want to use and which country site you used. We may ask for information to confirm your identity, and an authorized agent can act for you with proof of authority. We do not charge a fee unless the law permits one, for example for repeated or excessive requests.

We reply within the time your law sets, or, where it sets none, within a reasonable time. If we cannot meet your request in full, we tell you why. Some rights are limited by law, for example where we must keep data for legal reasons. You also have the right to complain to the data protection authority in your country. Annex 1 names some of them. We would welcome the chance to address your concern first.

11.Marketing communications

We do not currently send marketing emails or messages. We plan to send emails about new products, solutions, events and local promotions. We will send them only as the law of the recipient’s country allows and, where that law requires consent, only to people who have opted in. Each marketing message shows who we are, includes our contact details and has a free and easy way to unsubscribe, which we carry out promptly. We will keep sending you messages that are not marketing, such as replies to your enquiry.

We do not share your contact details with other companies for their own marketing.

12.Children

The Website is for business visitors and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact the Privacy Contact and we will delete it.

13.Links and social media

The Website links to our social media accounts and may link to other websites. We do not install social media plugins that collect data about you. We do not control other websites and their privacy practices. Read their policies before you share personal data with them.

14.Changes to this Policy

We may update this Policy to reflect changes in our practices, the Website or the law. The date at the top shows when it was last updated. If a change significantly affects how we use your personal data, we will tell you through the Website or by email, and obtain your consent where the law requires it.

15.Contact us

For questions about this Policy, requests under Section 10, or complaints, contact:

OYH Overseas Development Group Co., Ltd. (东方雨虹海外建设发展（上海）有限公司) Address: No. 3, Lane 889, Suide Road, Putuo District, Shanghai, China Email: privacy@oyh.com Telephone: +86 10 5903 1907

Annex 1  Country-specific terms

Each addendum below supplements and forms part of this Policy. It applies where the law it names applies to our handling of your personal data. If it conflicts with the main body, the addendum prevails to the extent your local law requires. Terms such as “data user”, “organization” and “controller” follow the local law and refer to the OYH entity that decides how your data is handled. If your country is not covered, the main body applies. Where local law requires, a translation of this Policy is available on the relevant country site.

A. Greater China

A.1 Mainland China

This part applies where the Personal Information Protection Law (PIPL) applies to our processing, whatever your nationality and wherever you live. The personal information handler is OYH Overseas. Section 6 and Section 7 describe the recipients of your personal information, the purposes and method of processing and the categories of information. You can get the names and contact details of overseas recipients from the Privacy Contact, through whom you may also exercise your PIPL rights against them. Where the PIPL requires your separate consent, for example to provide your information to another handler or abroad, we obtain it. You may also ask us to explain our processing rules. You may complain to the cyberspace administration authority or bring a claim in a competent court.

A.2 Hong Kong

This part applies where the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO) applies. The data user is Hong Kong Oriental Yuhong Development Limited, 737 Tai Kei Leng, Yuen Long, New Territories. Where a form marks a field as required, you must provide it, and if you do not we may not be able to respond to you. You may ask whether we hold personal data about you, and request access to and correction of it, by writing to the Privacy Contact. We reply within 40 days and may charge a reasonable fee for an access request. We use your name, contact details, job title and company for direct marketing only if you consent, and you can ask us to stop at any time, free of charge. We do not give your data to others for their own direct marketing. You may complain to the Office of the Privacy Commissioner for Personal Data (www.pcpd.org.hk).

B. Southeast Asia

Southeast Asia does not have a single data protection law. This addendum applies to Singapore, Malaysia, Indonesia, Thailand, Vietnam, Cambodia and the other Southeast Asian countries, where the data protection law of the country applies to our handling of your personal data.

B.1 Singapore

The Personal Data Protection Act 2012 (PDPA) applies. The organization responsible is OYH Overseas. You may withdraw consent by giving us reasonable notice, and we tell you the likely consequences. You may request access to and correction of your personal data. We transfer personal data outside Singapore as the PDPA allows. If we send marketing messages to Singapore telephone numbers, we comply with the Do Not Call provisions. You may complain to the Personal Data Protection Commission (www.pdpc.gov.sg), though we ask that you contact us first.

B.2 Malaysia

The Personal Data Protection Act 2010, as amended (PDPA) applies. The data user is OYH Overseas. You may request access to and correction of your personal data, withdraw consent, and ask us in writing to stop or not begin using your data for direct marketing. We transfer personal data outside Malaysia as the PDPA allows. A Bahasa Malaysia version of this Policy is available on the Malaysia site. You may complain to the Personal Data Protection Commissioner (www.pdp.gov.my).

B.3 Indonesia, Thailand, Vietnam, Cambodia and other Southeast Asian countries

The controller is OYH Overseas. Where the law of one of these countries applies, we process your personal data with your consent or on another basis that law allows, and you have the rights in Section 10 as that law provides, including the right to withdraw consent and to object to direct marketing. We respond to your requests within the period that law sets. We transfer personal data to other countries using the mechanisms that law permits, which may include your consent, contractual safeguards or another statutory basis. Where the law of Vietnam requires, we give you the information that law requires about transfers outside Vietnam, and your consent is voluntary, given separately for each purpose, and recorded. Cambodia has no comprehensive personal data protection law; we apply this Policy to the personal data collected through the Cambodia site. You may complain to the data protection authority of your country, such as the Ministry of Communication and Digital Affairs in Indonesia, the Personal Data Protection Committee in Thailand, the authority in charge of personal data protection under the Ministry of Public Security in Vietnam, or the Ministry of Commerce in Cambodia.

C. North America

C.1 United States

This part applies to residents of California and, to the extent they apply, other U.S. states. The business responsible is OYH Holdings LLC together with OYH Overseas. It is also our notice at collection for the Website.

In the 12 months before the date of this Policy, we collected the categories below, as the California Consumer Privacy Act (CCPA) defines them, from you, from your use of the Website, and from business partners and public business sources. We keep each category for the period in Section 8.

We have not collected sensitive personal information as the CCPA defines it. We have not sold personal information or shared it for cross-context behavioral advertising in the past 12 months, and we do not knowingly sell or share the personal information of anyone under 16. We disclose personal information for a business purpose to our service providers and group companies.

You have the right to know what personal information we collect, use and disclose; to request a copy; to delete or correct it; to opt out of sale or sharing (we do not sell or share); and not to be treated differently for using your rights. Applicants and business contacts in California have the same rights.

To make a request, you may email privacy@oyh.com. We verify your identity by matching the information you give us to the information we hold. An authorized agent can make a request with your signed permission. We confirm receipt within 10 business days and respond within 45 days. If we need more time, we may extend once by up to 45 more days and tell you why. If we deny a request under another state’s law, we tell you how to appeal. We treat a Global Privacy Control signal as an opt-out of sale or sharing; because we do not sell or share personal information, it does not change what we do.

C.2 Canada

This part applies where the Personal Information Protection and Electronic Documents Act, Quebec’s Law 25, Alberta’s or British Columbia’s Personal Information Protection Act, or Canada’s Anti-Spam Legislation applies. Our privacy officer is the Privacy Contact. We store and process your personal information in Mainland China, Hong Kong SAR, Singapore and the United States, and the authorities of those countries may be able to access it under their laws. We rely on express consent for marketing messages and non-essential cookies. You may complain to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or, in Quebec, the Commission d’accès à l’information du Québec (www.cai.gouv.qc.ca).

D. Latin America

D.1 Mexico

This part is also our privacy notice (aviso de privacidad) under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares, published 20 March 2025, and a Spanish version is available on the Mexico site. DF Rainbow, S.A.P.I. de C.V., at Río Tiber 53, Piso 5, Centro, Cuauhtémoc, 06500, Ciudad de México, is responsible for the personal data it collects through the Mexico site, how it is used and its protection. OYH Overseas also receives and processes the data.

The purposes necessary for us to deal with you are answering your enquiry, quotation or application; managing the commercial relationship; recruiting; and operating, securing and analyzing the use of the Website. The secondary purpose, which is not necessary, is sending you information about OYH products, solutions and events. You may refuse it through the separate box on our forms, by clicking “unsubscribe”, or by writing to us, and refusing does not affect the necessary purposes. We transfer your data to OYH group companies that operate under the same internal processes and policies as DF Rainbow without your consent. We transfer it to other third parties, such as a distributor you ask to be introduced to, only if you accept the transfer.

You may access, rectify, cancel or oppose the processing of your data (ARCO rights) and withdraw your consent. Send your request to contacto@oyh.com or to the address above, with your name and an address or other way to reply, a document that proves your identity or your representative’s authority, a clear description of the data and the right you want to use, and any other detail that helps us locate the data. We reply within 20 business days and, if your request is upheld, carry it out within 15 business days after our reply. You may complain to the Secretaría Anticorrupción y Buen Gobierno (www.gob.mx/buengobierno).

D.2 Brazil and other Latin American countries

This part applies where Brazil’s Lei Geral de Proteção de Dados (Law No. 13,709/2018) (LGPD) or the data protection law of another Latin American country applies. Our data protection contact (encarregado) is the Privacy Contact. We process data to take steps you ask for before entering into a contract, for our legitimate interests, and with your consent. You have the rights in Section 10 as the applicable law provides and, under the LGPD, may also ask for unnecessary or unlawfully processed data to be anonymized, blocked or deleted and learn with whom we have shared your data. We collect your data directly from you, and it is stored in and accessed from China (including Hong Kong SAR), Singapore and the United States. Where the LGPD’s rules on international transfer apply to our onward sharing of it, we follow them, including the standard contractual clauses of the National Data Protection Agency (ANPD) or, where the LGPD allows, your consent. You may petition the ANPD (www.gov.br/anpd).

E. Europe (EEA, United Kingdom and Switzerland)

The Website is not designed for individuals in the European Economic Area (EEA), the United Kingdom or Switzerland, and we have no establishment or country site there. This addendum applies where the EU General Data Protection Regulation (GDPR), the UK GDPR or the Swiss Federal Act on Data Protection applies to our handling of your personal data. OYH Overseas collects your data directly from you through the Website and is the controller; contact the Privacy Contact. We process your data to take steps at your request before entering into a contract (Article 6(1)(b) GDPR), for our legitimate interests in running a business-to-business operation (Article 6(1)(f)), and with your consent for marketing and non-essential cookies (Article 6(1)(a)). We do not process special categories of data on purpose.

You have the rights of access, rectification, erasure, restriction, portability and objection (including to direct marketing at any time), and the right to withdraw consent. We reply within one month, which the law allows us to extend in some cases.

Because we collect your data directly from you, it is stored in and accessed from mainland China, Hong Kong SAR, Singapore and the United States. These places are not all covered by an adequacy decision of the European Commission; the United States is covered only for recipients certified under the EU-U.S. Data Privacy Framework. Where the GDPR, the UK GDPR or the Swiss law has transfer rules that apply to our onward sharing of your data, for example with service providers, we follow them, for example under standard contractual clauses or, in the cases the law permits, with your consent. You can ask the Privacy Contact for more information. You may complain to the data protection authority in the country where you live or work, such as the Information Commissioner’s Office (www.ico.org.uk) in the United Kingdom or the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch) in Switzerland.

F. Middle East, Central Asia and Africa

This addendum applies to the United Arab Emirates, Saudi Arabia, Uzbekistan, Nigeria, Zambia, Ethiopia and the other countries of the Middle East, Central Asia and Africa, where the data protection law of the country applies to our handling of your personal data. The controller is OYH Overseas.

Basis for processing. We process your personal data with your consent or on another basis the local law allows. Some of these laws, such as the law of the United Arab Emirates, do not recognise legitimate interests as a basis, and in those countries we do not rely on them. We rely on your consent for marketing.

Transfers. We collect your data directly from you, and it is stored in and accessed from mainland China, Hong Kong SAR, Singapore and the United States. Where the local law has transfer rules that apply to us, we follow them, which may include your consent after we have told you the destinations and the risks, contractual safeguards, or another statutory basis. Where local law restricts storage of personal data outside the country, we apply that law to the data collected through the relevant country site.

Your rights and complaints. You have the rights in Section 10 as the local law provides, and we respond within the period that law sets. You may complain to the data protection authority of your country, such as the UAE Data Office, the Saudi Data and AI Authority (www.sdaia.gov.sa), the Nigeria Data Protection Commission (www.ndpc.gov.ng), the Data Protection Commissioner of Zambia, or the competent authority in Uzbekistan or Ethiopia.